> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opensourcemalware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API authentication with Bearer tokens

> Learn how to generate an API token from your profile settings and pass it correctly in the Authorization header for every API request.

Every request to the OpenSourceMalware API requires a valid API token. Tokens are tied to your account, are prefixed with `osm_`, and are passed as a Bearer token in the `Authorization` header. There is no OAuth flow. Authentication is a single header on every request.

## Getting a token

<Steps>
  <Step title="Sign in to OpenSourceMalware">
    Go to [opensourcemalware.com](https://opensourcemalware.com/auth) and sign in.
  </Step>

  <Step title="Open your profile settings">
    Click your avatar in the top-right corner and select **Settings**.
  </Step>

  <Step title="Generate a token">
    Navigate to the **API Tokens** section and click **Create Token**. Copy the token immediately (it's only shown once).

    <Frame>
      <img src="https://mintcdn.com/opensourcemalware/EvlidmjLpuT5sCp7/images/image-10.png?fit=max&auto=format&n=EvlidmjLpuT5sCp7&q=85&s=e6afb2eb91dc9cf61a8f3f517a52d33c" alt="Image" width="888" height="642" data-path="images/image-10.png" />
    </Frame>
  </Step>
</Steps>

<Warning>
  Keep your API token secret. Do not commit it to source control, include it in client-side code, or share it publicly. If your token is compromised, revoke it immediately from your profile settings and generate a new one.
</Warning>

## Using your token

Pass the token in the `Authorization` header of every request:

```text theme={null}
Authorization: Bearer osm_your_token
```

<CodeGroup>
  ```bash cURL theme={null}
  curl -H "Authorization: Bearer osm_your_token" \
    "https://api.opensourcemalware.com/functions/v1/check-malicious?report_type=package&resource_identifier=my-pkg&ecosystem=npm"
  ```

  ```python Python theme={null}
  import requests

  headers = {"Authorization": "Bearer osm_your_token"}
  params = {
      "report_type": "package",
      "resource_identifier": "my-pkg",
      "ecosystem": "npm"
  }

  response = requests.get(
      "https://api.opensourcemalware.com/functions/v1/check-malicious",
      headers=headers,
      params=params
  )
  print(response.json())
  ```

  ```javascript Node.js theme={null}
  const response = await fetch(
    "https://api.opensourcemalware.com/functions/v1/check-malicious?report_type=package&resource_identifier=my-pkg&ecosystem=npm",
    {
      headers: {
        Authorization: "Bearer osm_your_token",
      },
    }
  );
  const data = await response.json();
  console.log(data);
  ```
</CodeGroup>

## Invalid or missing tokens

If your token is missing, malformed, or has been revoked, the API returns a `401 Unauthorized` response:

```json theme={null}
{
  "error": "Unauthorized",
  "message": "Invalid or missing API token."
}
```